Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90681— Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds

Quick assessment

Affected
Matthias-Wandel jhead
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Matthias-Wandel 的 jhead 版本 3.3 及更早版本中发现了一个弱点。该问题影响 EXIF 解析组件中 exif.c 文件里的 Get16u 函数。这一操作会导致越界读取（out-of-bounds read）。此漏洞利用本地访问权限即可触发。利用该漏洞的攻击方法已向公众公开，可被用于发动攻击。项目方早已通过问题报告获知此问题，但至今尚未做出回应。

CVSS 3.3 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90681

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds
Source: CVE Program / CVE List V5
Vulnerability Description
A weakness has been identified in Matthias-Wandel jhead up to 3.3. This affects the function Get16u of the file exif.c of the component EXIF Parsing. This manipulation causes out-of-bounds read. The attack requires local access. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Matthias-Wandel jhead 3.0 cpe:2.3:a:matthias-wandel:jhead:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-90681

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90681

请登录查看更多情报信息。

Other References for CVE-2026-90681 (2)

Other References for CVE-2026-90681 (1)

IV. Related Vulnerabilities

Same product: jhead
Same vendor: Matthias-Wandel
Same weakness: CWE-125

V. Comments for CVE-2026-90681

No comments yet

Leave a comment